set default behavior to unauthenticated